AI Ethics, Bias, Privacy, Kenyan Context

The reason ethics matters now, not later

Kenya has very wide use of mobile phones and mobile money, so AI tools reach many people quickly, while the rules for AI are still being developed. That can mean people meet AI risks before protections arrive. Your awareness is your defence.

1. AI bias: and why it's not just a technical problem

AI learns from data. If the data reflects historical bias, the AI reproduces it. Classic examples:

• Some face recognition systems trained mostly on lighter-skinned faces have made more mistakes on darker-skinned faces, as the 2018 "Gender Shades" study and a 2019 US government (NIST) test of many systems found. In security uses, a mistake can mean a person is wrongly flagged.
• Loan-approval ML models trained on past lending data learn to disadvantage groups who were historically disadvantaged, even when the model never sees race or tribe directly, because it infers from proxies (address, school, phone model).
• Health AI trained mostly on patients from other regions may work less well for patients who are not like the people in its training data.

The only protection is awareness. When an AI makes a decision about you, loan denied, application rejected, transaction flagged, the Data Protection Act gives you rights to be informed and to object to decisions made only by automated means.

2. The Kenya Data Protection Act 2019: what you need to know

Kenya's DPA 2019 is one of the stronger data protection regimes in Africa. Every Kenyan needs to know these five rights (and every business needs to comply):

1. Right to know. Any organisation collecting your data must tell you what they're collecting, why, and how long they'll keep it.
2. Right to access. You can request a copy of everything an organisation holds about you.
3. Right to correction. Inaccurate data must be corrected.
4. Right to deletion. You can ask for your data to be deleted ("right to be forgotten").
5. Right to object to automated decisions. This is the AI-specific one: if an AI makes a significant decision about you (loan, job, insurance), you can request human review.

The Office of the Data Protection Commissioner (ODPC) enforces this, and the Act sets penalties for breaches. We do not quote the amounts here because the exact figures and conditions are in the Act itself. Read them on Kenya Law (kenyalaw.org).

If you're building ANYTHING that collects user data, even a simple form on your website, you're technically a "data controller" under the DPA. For small businesses this usually means: have a privacy policy, only collect data you need, don't sell it, respond to user requests.

3. Deepfakes and AI-generated misinformation

Cloning a voice can now need only a short recording of someone speaking. Fake video is harder but improving. The implications:

• Romance scams and mobile money fraud can use fake voices ("Mum, I've been in an accident, send money"). Defence: Agree a family password word. If it's not used, it's a scam.
• Political disinformation: deepfaked audio of politicians saying things they didn't say. Be extra careful around elections.
• Business impersonation: a boss's voice faked to ask for an urgent payment. Cases like this have been reported in other countries, so treat any urgent payment request with care.

Rule: any urgent request for money that arrives via voice or text should be verified by a second channel (a direct call, a meeting, another family member).

4. AI and copyright: the unsolved question

Is AI-generated content copyrightable? The Kenyan legal system hasn't fully answered. In the United States, courts and the Copyright Office have said that work made only by AI, with no human author, cannot be copyrighted. In Kenya the law is still catching up, and research centres such as CIPIT at Strathmore have written about AI and the law.

Practical rules for now:

• Don't claim AI-generated work as 100% your own if a client is paying for original creative. Disclose.
• AI-generated work is generally OK for drafts, internal docs, and starting points.
• If you're a student, check your school's AI policy. Many universities and schools have one. Submitting AI-written essays as your own work is usually a violation.
• If you're a teacher, your KICD-aligned materials must still be substantially your own work. AI-assisted outline → your own writing is fine. Wholly AI-generated schemes of work are a professional risk.

5. The responsible-use pledge

Before you close this module, commit to these five rules:

1. Verify facts. Never publish AI-generated names, dates, stats, or quotes without checking.
2. Disclose when material. If an AI wrote meaningful parts of something you're presenting as yours, say so.
3. Don't deepfake people without consent. Ever. Even jokes.
4. Respect data rights. If you collect any user data, know your DPA obligations.
5. Question AI decisions. If an AI denies you a loan, a grade, a job, ask for human review. The Data Protection Act gives you the right to object to decisions made only by automated means.

Read the text I will paste next. List every personal detail in it (names, phone numbers, ID or admission numbers, places, amounts linked to a person). Then rewrite it with those details replaced by [Name], [Phone], [Amount] and so on, so that I can safely ask an AI about it. Do not add any new facts.